Hackers Exploit WordPress Core code to be run remotely security flaw in Over 240,000 Attack Attempts

What happened

Attackers have launched more than 240,000 exploit (a piece of code that turns a flaw into a way in) attempts against a WordPress (content management system) Core upgrade-process flaw that can enable unauthenticated remote code execution (running programs on a machine from somewhere else). Wordfence researcher István Márton reported that targeting began on October 28, 2026.

The staged-installer remote code execution requires attackers to reach temporary installation files during an active upgrade.

The root cause is a time-of-check/time-of-use race condition involving predictable, web-accessible staging directories created during full-package Core upgrades. Hackers Exploit WordPress Core RCE Vulnerability These directories contain executable installer components beneath /wp-content/upgrade/ .

WordPress 7.1.4 introduces staging-directory randomization , an index guard, and restrictions against unsafe promotion of staged configuration data, reducing opportunities for installer abuse. Observed requests targeted paths such as /wp-content/upgrade/wordpress-6.9.11/setup-config.php , attempting to intercept sites while installer files remained accessible.

Tracked as CVE-2026-119977 (the public catalogue number for a specific software flaw), the high-severity issue carries a CVSS score of 8.1 and affects unpatched branches spanning WordPress 4.7 through 7.1.3.